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Poation papersdo not have any legal status in itsown right Subject matters dealt with in 
position papersare identified forspecific consideration and maybe matters controversial in 
nature, accounting treatment become relevant in orderto achieve consistencies in 
classification throughout the local government sector. 

Position papersneed to be read togetherwith the Project Summary Document asupdated 
periodically by National Treasury. 

Position papersDO NOTreplace any NationalTreasury guidelines, circulars, practice notesor 
implementation guidelines. 

Position papersare prepared by the mSCOA ProjectTeam based on information collected 
through the mSCOA Project Life cycle. Consultation with interested parties may be necessary in 
concluding on subject matters. 

Terminology applied in the position paperwill be specifically defined forupdating the Standard 
Terminology list as published on the NationalTreasury web aspartofthe mSCOA project 
documents 

Frequently asked questions received are used aspartofthe basis for research to cross 
reference to the specific queries for retaining the completeness of this source of information. 

Conclusion to be formulated on the position taken by NationalTreasury afterconducting 
consultation asmaybe defined by the mSCOA Technical WorkGroup, and supplemented by 
the viewsofthe mSCOA Project Steering Committee. 

Recommendations to the mSCOA Project Steering Committee may include appropriate 
reference to any NationalTreasury documentation requiring review following the outcome of 
the conclusion on the position paper. 
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BACKGROUND 

1. In the opinion of National Treasury, the mSCOA Regulation introduce more than only 
a financial reform but a significant change in municipal business processes and 
become an instrument facilitating organisational change involving more than only 
financial and budget orientated practitioners. The mSCOA implementation is 
considered to be a system conversion and/or reimplementation with all the major 
risks typically associated. 

2. Questions had been raised since the inception of the mSCOA Project on the role, 
responsibility and involvement of the municipalities risk management units and the 
internal auditors. 

3. This position paper focus on internal audit activities specific towards the mSCOA 
Project implementation at pilot and non-piloting municipalities. The use of this 
document is broader than only internal auditors thus includes more explanation on 
concepts and principles internal auditors should be familiar with. Please refer to 
Annexure A for explanations on terminology and concept used in the content. 

4. The Internal Audit Framework issued by National Treasury in March 2009 
comprehensively deals with the minimum requirements in complying with the 
Constitution of the Republic of South Africa, the Municipal Finance Management Act 
No 56 of 2003, The Institute of Internal Auditors'(IIA) International Standards for the 
Professional Practice of Internal Auditing (ISPPIA) and the Committee of Sponsoring 
Organizations of the Treadway Commission (COSO) framework on internal control, as 
well as the risk management framework. 

5. Internal audit is well positioned to add value to the conversion and/or re- 
implementation process and it should play a vital role in project assurance and 
governance. Effective contribution from internal audit require assessment and 
refinement of its capabilities, and partner with business units, the senior executive 
team and the audit committee. 

6. Internal Audit can help identify project risks early in the project lifecycle, which in 
turn will provide the municipality with sufficient time to course-correct and help 
obtain maximum value from the conversion and/or re-implementation of the system. 

7. The primary role of the internal audit entails evaluation of processes, people, 
technology, monitoring of the conversion/re-implementation, risk management and 
communication/education/training. Furthermore, internal audit is able to add value 
by prioritising needed changes or desired improvements. Ultimately, management 
"owns" the conversion/re-implementation with internal audit as a strong partner. 

8. Covered in the position papers is the role of the internal auditors in bringing value to 
the municipality by evaluating both the information technology (IT) and 
/organisational aspects of system conversation projects. Auditing these conversions 
provides assurance to management and the council that "all that can be done is 
being done". 
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9. The role of Internal Audit will differ per municipality according to the size, complexity 
and needs of the municipality. Therefore, some of the content might not be relevant 
or applicable to all municipalities. The Internal Audit departments will still need to 
apply the IIA Standards in their advisory or assurance provider capacity. 


l£G ISLATIVE REQUIREMEN15 

10. The Local Government: Municipal Finance Management Act (No 56 of 2003) section 
165 requires that each municipality/municipal entity must have an internal audit unit. 
In addition, the responsibilities prescribed by this act indicates that the internal audit 
unit of a municipality or municipal entity must: 

• prepare a risk-based audit plan and an internal audit program for each 
financial year; 

• advise the accounting officer and report to the audit committee on the 
implementation of the internal audit plan and matters relating to: 

• internal audit; 

• internal controls; 

• accounting procedures and practices; 

• risk and risk management; 

• performance management; 

• loss control; 

• compliance with this Act, the annual Division of Revenue Act and other 
applicable legislation; and 

• perform such other duties as may be assigned to it by the accounting officer. 

11. In addition to the above legislative requirements the internal auditors conduct their 
work based on the International Standards for the Professional Practice of Internal 
Auditing (ISPPIA) issued by the Certified Institute of Internal Auditors (CIA) and 
subscribe to the King III report. 


V\^ INVOLVE IN1ERNAL AUDIT 

12. The International Standards for the Professional Practice of Internal Auditing (ISPPIA) 
defines internal auditing as "an independent, objective assurance and consulting 
activity designed to add value and improve an organisation's operations. It helps an 
organisation accomplish its objectives by bringing a systematic, disciplined approach 
to evaluate and improve the effectiveness of risk management, control and 
governance processes." 

13. Internal Audit provides an independent and objective: 

• opinion (assurance) on risk management, control and governance, by 

measuring and evaluating their effectiveness in achieving the organisation's 
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agreed objectives. In addition, Internal audit's findings and recommendations 
are beneficial to line management in the audited areas. Risk management, 
control and governance comprise the policies, procedures and operations 
established to ensure the achievement of objectives, the appropriate 
assessment of risk, the reliability of internal control and external reporting and 
accountability processes, compliance with applicable laws and regulations, and 
compliance with the behavioural and ethical standards set for the municipality; 
and 

• consultancy/advisory service specifically to help line management improve the 
municipality's risk management, control and governance. The service applies 
the professional skills of internal audit through a systematic and disciplined 
evaluation of the policies, procedures and operations that management put in 
place to ensure the achievement of the municipality's objectives, and through 
recommendations for improvement. Such consultancy work contributes to the 
opinion which an internal audit provides on risk management, control and 
governance. 

14. Internal Audit should provide assurance and/or advice to senior management 
Council, the Audit Committee and other stakeholders on: 

• Project governance, including policies, procedures and controls. 

• Business case validity, viability and whether worthwhile and feasible. 

• Project planning matters such as the critical path, completeness and 
suitability. 

• Change management attending to adherence to controls in the business 
processes and timeliness. 

• Risk and issue management addressing depth, coverage and resolution. 

• Project costs considering actual, compared to budgeted. 

• Sign-off and criteria for stage gates. 

• Approach to vendor management for example contracting, dependencies and 
management involvement in process ownership and decision making. 

• Business readiness "pre-go-live.. 

• Project communications being accurate, sufficiently detailed and realistic. 


V\^Byi SHOULD INTERNALAUDfTBE INVOLVED? 

15. The earlier the internal auditors get involved the better since it will increase the 
internal auditors understanding of the project's lifecycle and its key benefits, 
requirements, drivers and objectives. This enables internal audit to contribute to the 
project as it defines its risk management approach and strategy. 

16. Internal audit's involvement at an early stage ensures greater alignment of the risk 
management principles to those of the municipality itself. It also allows internal 
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audit to establish and confirm its future involvement and method of engagement on 
the level of inherent risk in the conversion/re-implementation of the system. 

17. Benefits of engaging internal audit early on in the project lifecycle include: 

• Better organisational readiness. 

• Early identification, greater understanding and improved resolution of issues. 

• Increased likelihood of delivering the project on scope, on time and on budget. 

• Better change management so that new systems are embraced. 

• Increased project control to maximise efficiency. 

• Improved ability of the internal audit and risk management functions to 
provide a thorough assurance solution. 


THE ROl£ OF IN1ERNAL AUDTTTHROUG H THE PROJ ECTUFEC YC l£ 

Internal audit has a role to play throughout the project lifecycle. The table included 
hereunder provides a summary of some activities within the phases of the project 
lifecycle. 
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Planning 

Execution & 

Control 

Completion 

Benefits 

• Project 
governance 

process e.g. 
review of Project 
Implementation 
Plan 

Management / 
Council 




HOW CAN INIERNALAUDTTHEIF? 

18. The two questions most commonly asked of internal audit by senior management, 
council, the audit committee and other stakeholders when faced with a significant 
initiative are: 

• Are we doing the right things? 

• Are we doing them in the right way? 

19. Internal audit's involvement should be tailored to address these questions and to 
meet the unique risks of the program. 

Are we doing the right things? 

Initial Risk Assessment of the Project 

20. Through this step. Internal Audit can understand the key elements of the project, 
including approach, methodology, activities, timelines, resources and requirements. 
This step helps determine the specific processes and controls that are in place, and 
identifies the key risks for internal audit to tailor the detailed checkpoint reviews to 
cover the risks. 

Performing ongoing "Health Checks" 

21. Ongoing reviews by the internal audit assist in ensuring the key risks related to the 
project scope, timelines, cost and deliverables are identified and appropriately 
managed. 

22. The timing and scope should be adjusted to address project risks, status, milestones 
and audit committee-, senior management- or Council requirements, based on lA's 
assessment. 

Are we doing the right things in the right way? 

23. Risks can quickly become major issues during the course of large projects. It's 
imperative for internal audit to be involved at the individual work stream level to 
help identify and monitor key risks. The aspects of project management listed in the 


Final Position Paper for Discussion at the Technical Work Group - 20 July 2016 



mSCOA POSmON PAPER: 

IHE ROLEOFIHE INTERNAL AUDIIOR IN SYSIEM CONVERSION FOR 
mSCOA IMPLEMENTATION 


paragraphs to follow are critical success factors where the internal auditors can 
perform assurance or provide value-adding advice. 

Business Case Validation 

24. Even before the actual program begins, key questions, assumptions, analyses and 
other components of the business case may be misaligned with the corporate 
strategy, organisational structure and capability, technical complexity and 
competency or a number of other factors. 

25. Emerging trends relevant to the sector, forthcoming regulatory developments and 
evolving technology can also compromise elements of the business case. Reference 
and validation back to the business case through the project lifecycle is a leading 
practice. 

26. How can internal audit assist? 

• Evaluate the linkage between project metrics and strategy when the business 
case is prepared. 

• Evaluate individual components and challenge assumptions within the 
business case as it is presented. 

• Support the program team in the benefits tracking and realization process 
during project execution. 


PROJ ECTIMP1EMEN1ATION: A PEOPIE, PROCESS^ TECHNOLOGY AND RISK 
MANAG BVIENT PERSPECTIVE 

27. Large projects need to focus on successful process alignment, technology 
deployment, people engagement and risk management. There are some critical 
components that form part of the decision to go live and help the project stay on 
track. Internal Audit can help with both the decision to go live and in measuring the 
success of the program applying a lens of people, process and technology. 

Process 

28. Internal Audit can help: 

• Verify that standard operating procedures are in place. 

• Validate completion of testing and data conversion processes. 

• Advise and help identify relevant key process-level risks and control gaps. 

• Support the design of business process controls to mitigate process-level risks 
and provide certification analysis. 

• Evaluate "go-live" processes such as the creation of a transition team, parallel 
runs, crossover steps, contingency plans (including roll-back), end-user 
computing and output demands, risk management and issue escalation and 
resolution. 
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• Evaluate transition plans and identify any operational and organisational 
issues that are critical to launch. 

• Assess whether any duplications exist in systems or efforts. 

• Ensure interdependent risks are being managed. 

Technology 

29. Internal Audit can help: 

• Ensure that functional needs, including forms and reports, are in place. 

• Audit hardware and software environment (operating system, network, user 
workstations, printers). 

• Check interface projects. 

• Measure application, operating system and network security. 

• Evaluate transition plans for technical processes and data. 

• Evaluate IT system integration and data migration in terms of both quality and 
security. 

• Validate and track benefits and cost savings. 

People 

30. Internal Audit can help: 

• Check whether end-user training and guides, including transition readiness 
are in place. 

• Provide an analysis on post-implementation sustainability. 

• Measure resource utilisation. 

• Control and assess culture within the organisation. 

• Analyse whether skills and capability of the team are well suited to the 
project. 

Risk Management 

31. Internal Audit can help: 

• Be the eyes and ears of the audit committee. 

• Evaluate the risks inherent in the conversion process. 

• Monitor changes to the overall organisation risk profile. 

• Re-prioritise audit focus, as appropriate, given the demands of conversion. 

• Communicate audit plan focus and changes to the audit committee. 

• Collaborate and coordinate with other risk management functions. 
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• Monitor the conversion impact on the internal controls. 


THEROIEOFINIERNALAUDITIN SYSIEM CONVERSION ORRE-IMPLBVIENIATION 

32. Internal auditors play a valuable role in ensuring that information technology (IT) 
investments are well-managed and have a positive impact on the environment. Their 
assurance role supports senior management, the audit committee, the council and 
other stakeholders. Internal auditors follow a risk-based approach in planning their 
audit activities. Audit best practices suggest internal auditors should be involved 
throughout a project's life cycle - not just in post-implementation assessments. 

33. Converting from old to new systems is an important aspect of the audit planning 
process, not to be underestimated. Implementing a new system usually requires a 
variety of system changes; production data conversion and migration, new 
operational policies and procedures. Each of these areas poses significant risk to the 
municipality during the actual system conversion. Consequently, conversion audit 
efforts typically focus on reviewing plans and results for: 

• The overall implementation of the IT solution. 

• The systems that are required to implement the IT solution. 

• The operational changes required within the municipality as part of the 
implementation. 

34. When planning system conversion audits, internal auditors need a good 
understanding of the business requirements for the system, the project's risks and 
how the proposed system will work. To understand the solution, they must identify 
the various operational and system changes that will be implemented. Project 
information may become available over time; some audit planning will have to be 
completed on an interactive basis. 

35. Conversion audits should be done commencing with the project planning, and 
frequent and timely reporting of the findings. Being involved early in the project 
initiative is vital to developing a good understanding of the project's issues, 
challenges, and risks, as well as what management is doing to address them. Ideally 
the audit activity need to be scoped from the business plan or case for change, 
council as early as possible, before it is approved by the municipalities executives or 
where applicable. 

36. A good audit practice is to complete a short "lessons learned" review of the audit 
efforts performed throughout the conversion audit and apply them to the generic 
conversion audit process. 

37. Internal auditors should determine their level of involvement and approach during 
the project's initiation phase. The audit involvement decision should be based on the 
project's risk assessment, as well as factors such as the project team's project 
management experience, level of management involvement, size and complexity of 
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the initiative, and impact on the organization should the initiative be delayed or 
unsuccessfully implemented. 

38. The most appropriate audit approach needs to be defined during the audit project 
planning phase. Following step 1 of the generic eight-step audit process will 
complete the definition of audit's level of involvement. Further adjustment of audit 
involvement may be required depending on the results of the project's efforts and 
auditors' assessment throughout the project's life cycle. Another important 
consideration to discuss with management and the project team is the internal 
auditors' roles and responsibilities in attending project team meetings throughout 
the conversion audit. 


AUDITOR EC11VESSPECIHC lO SYSIEM CONVERSION ORRE-IMPIEVIENIATION 

39. Internal auditors' involvement with a system conversion typically involves reviewing 
and assessing the overall project plan and project management. 

40. The internal audit function in reviewing the overall project plan should consider 
whether the budget is adequate or excessive by benchmarking with other similar 
municipalities. 

41. Internal auditors should also assess the accuracy and completeness of the systems 
and data requirements for the IT solution, including: 

• Evaluating and monitoring management's project plans for the various system 
changes that are required. 

• Data cleaning is one of the most problematic areas and it is critical that clean 
data gets moved to the "new systems" for mSCOA implementation. 

Therefore, it is imperative that the data cleaning prior to the "move" should 
be tested properly. 

• Assessing the completeness and appropriateness of management's systems 
and database design, including the security aspects. 

• Reviewing the user-acceptance and parallel test planning and results to 
demonstrate successful end-to-end system operations and preparedness for 
implementation. In a parallel test, the project team simultaneously tests both 
the old and new systems using the same data and compares their results in a 
comprehensive manner. 

• Reviewing the start-up of production systems and associated client data to 
ensure data integrity is maintained and back-out plans in the event of a 
problem are effective. 

42. In addition, internal auditors should assess the accuracy and completeness of the 
start-up of operational responsibilities within the municipality by: 

• Evaluating and monitoring management's project plans for the various 
operational requirements. 
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• Assessing the completeness and appropriateness of the operational policies 
and procedures that are developed. 

43. Finally, internal auditors should assess the risk-management processes applied by 
project management to ensure that they are followed throughout the project. 
Identifying and assessing the risk involved during the various stages of the project will 
reduce the risk to the municipality by ensuring that implementation of the IT solution 
is controlled and accurate. The audit objectives are finalised during detailed audit 
project planning. 


BGHT-SIEPSTO CONSIDERIN THE INIERNALAUDTrPROCESS 

44. The following process describes the steps to be completed by internal auditors for a 
typical system conversion/re-implementation. These straightforward and flexible 
steps include the IT and non-IT aspects of the conversion. 

45. Depending on a variety of factors such as the size, complexity, and time frame of the 
systems project this generic internal audit process should be refined and finalised 
during the detailed audit project planning phase. 

Step 1: Understand the IT Initiative and Project Plan 

46. Internal auditors should review with both the project's management team and the 
business units the scope of the initiative, supporting project plans, high-level 
implementation plans and schedules; and proposed implementation programs and 
project controls. 

47. A good understanding of the overall solution is needed to provide the big-picture 
context in support of the audit risk assessment and detailed audit-planning effort. It 
is important to understand how the system benefits the municipality and what the 
system's role will be in delivering business objectives. It is also important that the 
project team develop well-documented objectives and have them approved by 
management. 

48. During this step, internal auditors should also finalise the system conversion audit 
plan by modifying the generic audit process to reflect the actual IT project's 
objectives, issues, and assurance needs. 

49. The high-level risk assessment would further guide the system-conversion audit- 
planning process. The actual level of audit involvement and audit approach should 
be determined by internal auditors during a detailed audit project planning phase 
when the first step of the process is finalised. 
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Step 2: Complete a Risk Assessment of the Operational Changes Planned relating 
to the mSCOA System Implementation 

50. Internal auditors should develop a detailed understanding of the operational changes 
driven by the system implementation that are being planned and facilitate an 
independent risk assessment of those changes. 

51. Without an ongoing risk assessment process, surprises will occur frequently, with 
negative consequences to the schedule, cost, and quality. The adequacy of controls 
put in place to address the risks identified, as well as the effectiveness of these 
controls, determine the scope of testing to be done by the internal audit activity. The 
results of this analysis should be factored into the project team's plans and focus. 

52. The audit risk assessment should be documented in the internal audit readiness 
analysis. 

Step 3: Assess the Project and Implementation Plans 

53. Internal auditors should complete an assessment of the appropriateness of the 
project plans, implementation and testing plans, and data-conversion program 
specifications that are being developed. Auditors should provide feedback about 
their assessment of the implementation approach to the project's management 
team. 

54. The project team and management benefit from receiving an independent 
assessment of the project efforts and plans, because the intense pressure to show 
early progress often causes some important aspects of planning to be overlooked. 
Having internal auditors review the early project efforts further assures stakeholders 
that all important aspects of the project have been considered in planning. 

55. The internal auditors' views on the new system's internal controls can benefit the 
implementation of the overall solution, which system may not be as robust as mature 
legacy systems that have had years of controls hardening. 

Step 4: Assess the Data Mapping efforts and the Operational Changes Planned 

56. Internal auditors should assess the adequacy and completeness of the planned data 
conversion control reporting, including a review of the system data mapping for the 
implementation of changes to production data, if any. Data mapping sets the 
necessary foundation for maintaining the integrity of the production data during 
implementation. ^In addition, the historical requirements for data can be extensive. 

57. During this step, internal auditors need to assess the adequacy and completeness of 
data mapping for implementing production data by reviewing the systems data. 


1. ^ . Position Paper on Historical Information Critical 
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mapping itself, and the controls and reporting with regard to this activity. Special 
attention should be given to the impact the data conversion has on other systems 
that are not involved in the conversion. This is a high-risk area in all conversions, 
because downstream systems may be affected in unexpected ways. 

Step 5: Assess the Adequacy of Testing Plans 

58. At this stage, internal auditors should assess the adequacy of the testing plans, the 
data-conversion control reports to be used, and test scripts involved with the 
implementation. 

59. Internal audit should ensure that appropriate project resources have been assigned 
to this activity, so that the level of testing efforts reflects the risks involved. 

60. Internal audit should review the assignment of responsibilities (i.e.. Who does what?) 
and related service level agreements for completeness and appropriateness. Further 
to this review the project's outputs regarding business and IT processes envisioned 
for implementation. 

61. Finally, review and feedback on the implementation plans should be provided to the 
project management team, where appropriate. 

Step 6: Complete an Implementation Readiness Assessment 

62. Internal auditors should complete a high-level readiness assessment of the 
municipality's ability to implement the required operational and system changes. 

63. This analysis will identify whether or not additional management efforts are required 
to complete the preparation for the actual conversion. 

64. Internal audit should review the documentation being developed to support the 
solution's implementation and operation user training materials, new and refined 
policies and procedures, internal and external communication, and other key project 
outputs as determined in the previous steps. 

65. The audit conversion readiness assessment should be documented in an internal 
audit worksheet usually a one- or two-page high-level summary. 

66. The internal audit report should also be provided to management before the 
solution's implementation. 

67. As part of the audit feedback to project management, internal auditors should also 
attend key project management check-point meetings and provide their views 
verbally. 

Step 7: Develop and execute the audit verification plan 

68. Internal auditors should complete the detailed audit program to review production 
implementation. At implementation, management, council and the audit committee 
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will look to internal auditors to provide additional assurance that the implementation 
is executed prudently and successfully. 

69. The audit tests will usually focus on reviewing the results of the project team- and 
business unit's test results. This includes reviewing the results of the start-up at the 
first site and monitoring the rollout at the other sites if the conversion is a multi-site 
implementation. 

70. A review of the testing of the initial production operations using the new solution 
should also be completed. 

Step 8: Complete the Overall Audit Analysis of the Implementation 

71. Internal auditors should complete the audit analysis of the results of the 
implementation and the management actions that have been completed to address 
any issues that were raised during the actual implementation. 

72. In major conversions with many implementation activities, some operational issues 
that were not considered ahead of time may need to be addressed during 
implementation. For example, an obscure data conversion problem may occur for a 
minor data element, requiring manual corrections to be instituted to allow the 
implementation to go forward. Management review of this manual effort following 
implementation might be recommended to ensure nothing significant was missed. 

73. Decommissioning the old system can be another challenge facing management, in 
ensuring appropriate efforts are completed for this area to be productive. Reviewing 
the archiving and retrieval controls from the old system to ensure that access to the 
information is available and adequately protected should not be neglected. 

74. A post-implementation audit report on the adequacy, effectiveness and accuracy of 
the implementation should be developed and presented to management. 

75. The internal auditors should complete the working paper file. 

Reporting and Concluding 

76. Reporting of audit results can also be flexible, for example, if the auditors feel it is 
important to communicate concerns, they can do so throughout the project; 
otherwise, they should normally produce written pre-implementation and post- 
implementation audit reports. By being involved early in the IT project, auditors can 
informally raise questions and suggestions that influence a project without actually 
making formal audit recommendations. 

77. Internal audit should voice concerns during the project if they believe management is 
not taking the more informal recommendations seriously and they feel their concerns 
need to be escalated to senior management or the audit committee. The internal 
auditors typically report to the audit committee twice a year about IT projects, 
detailing audit efforts that are in progress but have not been reported to senior 
management. 
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CONCLUSION 

78. Internal audit can help with both the decision to go live and in measuring the success 
of the program applying a lens of people, process and technology. The involvement 
of internal audit at an early stage of the project life cycle towards mSCOA 
implementation is critically important. 

79. A quote from an article published by the Institute of Internal Auditors: "A Conversion 
to a new system is one of the highest risks that any organisation can face, internal 
auditor's involvement and independent assessment of the issues and project plans 
can provide value far in excess of the audit's costs. " 


RECOMMENDATIOII 

1. The mSCOA Project Steering Committee to note 


• Versionl of this Position Paper on Debt Impairment and Write-off was 


discussed and presented to the ICF at the 9 September 2015. 

» Content discussed and agreement reached by the OAG with the ASB on 15 


February 20160. 

» 

Comment period offered to the ASB Forum Members and invitation 
extended to all municipalities / provincial treasuries from beginning oi 


March to 8 April 2016. Comments received up to 12 July 2016 considered 

in finalisation of the Position Paper. 


» Posit ion Paper to be recommended for publishing to the National Treasury 
WebJ 


SOURC ES OF REFERENC E: 

80. IT Compliance Institute 

81. National Treasury Internal Audit Framework 

82. The Institute of Internal Auditors 

83. City of Cape Town Internal Audit Department 

84. Ernst and Young Internal Audit Department 
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ANNEXUREA: SPECIHC CONSIDERATION PORTHE ATIENHON OFTHE INIERNAL 
AUDnORIN PLANNING AUDTTACTIVniES 

86. The table presented hereunder provide some consideration for the internal auditor in 
assessing the municipality's preparation for mSCOA implementation and the 
underlying system conversion. 


CONSIDERATION 

CLASSIFICATION 

A. 

Strategic and Political Awareness and Responsibility 

1. 

Council briefed on mSCOA concepts. 

Regular update on progress made 
upon implementation, challenges 
and risk response. 

Political 

awareness 

2. 

mSCOA Implementation and system 
conversation accepted as a strategic 
objective and defined as such in the 
municipality strategic and business 
plan. 

Strategic 
recognition and 
project support 

3. 

Project assigned to senior manager 
to oversee, manage and define 
project activities. Specific 
consideration to be given to the 
team composition verifying that the 
'people' part of the implementation 
is covered in the project plan 
especially change management and 
training, review of job profiles and 
where necessary job titles. 

Strategic 
recognition and 
project support 

4. 

mSCOA outcomes defined as an 
"organisational key performance 
area" and supported by senior 
manager and staff personalised 
performance agreements. 

Strategic 
recognition and 
project support 

5. 

Organisational and business risk 
assessed and managed through the 
formalised risk management process 
of the municipality. 

Risk 

Committee/Risk 

Management 

Activities 

6. 

Project manager overseeing the 
preparation of a comprehensive 
project plan, defined milestones and 
adequate resource allocation. Some 
critical matters to consider and 
managed through the project plan: 

Project 

Management and 

Oversight 


> Sufficient detail to define impact 
on the whole of the municipality. 

> Implementation requirements 
defined by consulting all 
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CONSIDERATION 

CLASSIFICATION 


business areas and levels of 

staff. 

> Adequate sharing of 
information. 

> Define and address impact on 
business processes. 

> Time allocation for activities. 

> Response to delays. 

> Request for assistance and 
technical support. 

> Resource allocation. 


7. 

> Succession planning of key 
responsibilities and hedging of 
risks associated. 

> Project documentation and audit 
trail. 

> Activities sufficiently 
documented, decisions recorded 
and actions taken to record all 
activities for reference purposes. 

> Documentation of system 
changes and business process 
consideration to retain an audit 

trail. 

Project 

Management and 

Oversight 

8. 

Budget provision adequate to 
support the mSCOA/System 

Conversion process. Control being 
exercised over utilisation of 
budgeted resources. 

Project 

Management and 

Oversight 

9. 

mSCOA Version Control - process 
defined to ensure activities aligned 
to the latest release of mSCOA. 

Alternatively, the decision might 
have been taken to work on a 
specific release and at a later stage 
to assess changes made in a later 
release and update activities for 
implementation. 

Project 

Management and 

Oversight 

10. 

The role and involvement of System 

Vendors defined. 

Project 

Management and 

Oversight 

11. 

Change Management, sharing 
information, involvement of various 
levels in business process 
integration. Attendants to meetings 

Change 

Management 
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CONSIDERATION 

CLASSIFICATION 


sharing knowledge through 
formalised communication channels. 
Institutionalised training to prepare 
all levels of staff on the business 
process requirements, mSCOA 
application within system 
environment, revised budget 
requirements and potential impact 
on business reports. 


12. 

Integrity of data after "data 
cleaning" need to be verified before 
converting to the new system. 

Important that this exercise need to 
be completed priot to conversion. 


13. 

Access to historical information, 
conversion done to new system 
defined. Audit trail for all balances 
converted, unbundled or 
consolidated. 

Secure 

Information 

14. 

Concerns, questions and 
uncertainties logged in FAQ with 

National Treasury resolved. 

Change 

Management 

B. 

Function/Municipal Standard Classification 

1. 

Association of Function Classification 
to Municipal Standard Classification 
adequate and within the "function 
definition". 

Customisation 

2. 

Appropriate decision made on "core 
vs non-core" functions. 

Customisation 

3. 

Consider appropriateness of detail 
added to classification is within the 
definition of the "parent account". 

Customisation 

4. 

Code structure correctly set-up for 
"children" added to the structure. 

Customisation 

C. 

Project 

1. 

Capital projects defined within the 
concept of the IDP. Also consider 
other sources of information used. 

Customisation 

2. 

Construction Work-in-progress - 
balance split to defined projects. 

Customisation 

3. 

Project used as the driver for setting- 
up budgets. 

Customisation 

4. 

Repairs and maintenance dealt with 
as an operational project. 

Customisation 

5. 

Code structure correctly set-up for 
"children" added to the structure. 

Customisation 
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CONSIDERATION 

CLASSIFICATION 

6. 

Consider descriptions used for 
projects - no general, special, other, 
etc. projects created. 

Customisation 

D. 

Regional Indicator 

1. 

Information provided to mSCOA to 
add to Tables. 

Customisation 

2. 

Code structure correctly set-up for 
"children" added to the structure. 

Customisation 

E. 

Funding 

1. 

Funding detail customised by the 
municipality. 

Customisation 

2. 

Code structure correctly set-up for 
"children" added to the structure. 

Customisation 

3. 

Process followed in setting up 
"opening balances"? 

Customisation 

F. 

Item 

1. 

Municipality customised mSCOA 
accounts to only what is needed? 

Customisation 

2. 

Cash Equivalents, Investments, 

Current and Non-current Borrowings 
set-up based on detail relevant to 
the municipality. 

Customisation 

3. 

Property, Plant and Equipment - 
asset register classification aligned 
to high-level categories as per 
mSCOA in accordance with 
guidelines. 

Customisation 

4. 

Code structure correctly set-up for 
"children" added to the structure. 

Customisation 

G. 

Compliance Requirements 

1. 

Code Structure - short code 

conversion tables to mSCOA codes 

Customisation 

2. 

mSCOA Regulation Compliance to all 
requirements. 

Customisation 

3. 

Extraction of import files without 
manual interference. 

Customisation 

4. 

Only be added if provides for 
"breakdown allowed". 

Customisation 

H. 

Financial Statements and Budget Preparation 

1. 

Restatement of Comparatives - 
sufficient audit trail to support 
changes made. 

Balance 

Verification 

2. 

Audit trail supporting unbundling of 
opening balances 

Balance 

Verification 
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CONSIDERATION 

CLASSIFICATION 

3. 

Process defined for converting 

Balance 


opening balance, closing of "old 
system" and roll over to new system. 

Verification 

4. 

Processing of year closing entries, 

Balance 


including audit adjustments to old 
system and new system - depending 
on the process defined. 

Verification 

5. 

Budget for implementation year 

Balance 


prepared using mSCOA. The allowed 
alternative during the 
implementation phase may entail 
that the approved budget not 
necessary compiled using mSCOA 
(either not the going life version) be 
converted to the actual version used 
for "going life. This conversion 
including the "adjustment budget" 
must be approved by Council. 

Verification 
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ANNEXUREB- KEY CONCEPISANDPRINCIPIES EXTRACTED FROM THE 
NATIONALTREASURY imERNALAUDrTFRAME\AiORK 

1. Various internal audit methodologies are applied by internal auditors. The paragraphs 
to follow provide for extracts of key principles and definitions based on a generally 
accepted framework for local government used as basis to prepare this document. 

Internal Audit Activity (lAA) 

2. The International Standards for the Professional Practice of Internal Auditing (ISPPIA) 
defines internal auditing as "an independent, objective assurance and consulting 
activity designed to add value and improve an organisation's operations. It helps an 
organisation accomplish its objectives by bringing a systematic, disciplined approach 
to evaluate and improve the effectiveness of risk management, control and 
governance processes." 

Governance Processes 

3. The role of the internal audit activity with respect to good governance should be to 
assist the organisation in achieving its goals, creating and maintaining particular 
values. It does so through the appropriate accountability and by evaluating 
processes that contribute to the achievement of these goals and values, specifically 
the communication of the goals and values and the processes used to monitor their 
respective achievement. 

Risk Management 

4. Risk management is an essential part of effective corporate governance and whilst it 
is a management responsibility, management expects the audit committee to 
oversee and provide advice on the organisation's risk management. The audit 
committee needs to review: 

• Whether management has a comprehensive risk management framework; 

• Whether a sound and effective approach has been followed in developing 
strategic risk management plans; 

• The impact of the organisation's risk management framework on the control 
environment; and 

• The organisation's fraud prevention plan to be satisfied that the organisation 
has appropriate processes and systems in place to capture, monitor and 
effectively investigate fraudulent activities. 

Risk Management Processes 

5. Risk management is a key responsibility of management and the accounting officer. 
Internal auditors should assist both management and the audit committee by 
examining, evaluating and reporting on the adequacy and effectiveness of the risk 
management process. 
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Risk Management Activities 

6. Management is responsible for ensuring the establishment of effective risk 
management in the organisation. The approach followed provides a mechanism of 
formalising the responsibility and establishing accountability for management 
activities. This is often achieved through the establishment of a "Risk Committee" 
function. Its efforts should identify further actions that may be needed to reduce risk 
to an acceptable level. 

Risk Based Planning 

7. Risk based planning means finding the correct balance of risk based versus cyclical 
based audits. This balance depends on the maturity of an organisation's systems and 
processes, the extent to which policies and procedures and internal controls are 
entrenched and complied with, and the general strength of the wider control 
environment. Best practice is that the internal audit activity spends most of its time 
on risk-based audits, and the rest on cyclical-based audits, follow-up audits and ad 
hoc requests. 

Risk Based Audits 

8. Given the results from the risk assessments performed (which generally indicate only 
a satisfactory-to-weak control environment) it may be appropriate for the internal 
audit activity to focus its attention on the high risk areas, mostly concentrating on 
ensuring that key controls are in place and adhered to. 

Internal Control Processes 

9. The operation of internal control systems is the responsibility of the relevant line 
managers. 

10. The internal audit activity should evaluate the existing controls in terms of their 
adequacy and effectiveness, assessing the change in the likelihood of any risk 
materialising, and develop recommendations for their improvement. 
Recommendations should always add value, and should be measured against the 
reduction of the likelihood that a risk can materialise. 

11. The internal audit activity is a key factor in ensuring that an organisation is effectively 
managed and that its resources are not misused or misappropriated. 

12. Internal controls are not limited to financial matters but apply to operations as well. 
Essentially, it is a management system, culture and set of values designed to ensure 
that the organisation is managed efficiently and effectively, with the appropriate 
policies and procedures that promote the achievement of its overall goals and 
objectives. 

Control Environment and System of Internal Control 

13. The control environment would include the internal auditor's responsibility on 
reporting to the audit committee on the control environment and in return the audit 
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committee's responsibility commenting in the internal controls of the municipality 
annually. It would also include the existence and maturity of a combined assurance 
model and implementation thereof. Furthermore, if the municipality has formally 
adopted a control environment and system if internal controls this framework will be 
relevant in light of the mSCOA implementation and conversion/re-implementation. 

14. Internal audit activity is an important component of internal control, risk 
management and corporate governance and provides the necessary assurance and 
advisory services to the organisation. 

15. An internal audit activity is one of the most significant management tools and can 
provide value-added services to the organisation. When objectively and adequately 
resourced, an internal audit activity should be in a position to provide management 
with much of the assurance it requires regarding the effectiveness and adequacy of 
the system of internal control, risk management and governance processes. 

16. The internal audit activity must be well planned, organised, staffed, trained, directed 
and monitored. 

17. Internal audits must be conducted in accordance with the standards set by the 
Institute of Internal Auditors (IIA). These standards, together with the various 
implementation guides according to the International Professional Practice 
Framework updates issued by the IIA provide much of the guidance required by the 
internal audit activity for conducting its work. 

Roles and Responsibilities of the Audit Committee 

18. The roles and responsibilities of an audit committee should be determined by the 
accounting officer in consultation with the external auditor taking into account the 
following: 

• the organisation's size, complexity and nature of its business; 

• nature of governance structures; 

• maturity of organisation's risk and control environment; 

• skills, experience and personal qualities of potential members; and 

• mechanisms and processes which need to be established to enable the audit 
committee to meet its responsibilities. 

Relationship with the Office of the Auditor- General/External Auditors 

19. In terms of the International Standards for the Professional Practice of Internal Audit 
(ISPPIA) the internal audit activity should share information and co-ordinate its 
activities with those of the internal and external providers of assurance and 
consulting services. This is done to ensure appropriate coverage of risk areas and 
minimise duplication of efforts. 

20. There should be mutual access to audit plans and programs, as well as audit reports. 

It is recommended that periodic meetings be held between the internal audit activity 
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and external audit. At these meetings key risks should be discussed, audit scopes 
should be shared, priorities should be emphasised and findings should be discussed. 

21. The internal audit activity can assist external auditors obtain an in-depth level of 
understanding of the audit client's business. The external auditors are mainly 
concerned with the fair presentation of the organisation's financial statements. 

22. In terms of the ISPPIA the internal audit activity should share information and co- 
ordinate its activities with those of the internal and external providers of assurance 
and consulting services. This is done to ensure appropriate coverage of risk areas and 
minimise exposure. Further to this the impact of co-ordination efforts provides 
combined assurance to the audit committee and council. 
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ANNEKUREC: COMMBSnS AND QUERIES RECBVED INFORMING 1HEPROB1EM SIAIEMENT 


Reference / Date 

From 

Number 

Query 

Response 

Email 

Query 

Hugo van Aarde 

Sebata 


The document is comprehensive. The following is 
my concerns: - 

Comment Noted 




What happens if the municipality does not have an 
internal function or do not have the capacity within 
the internal audit function to perform this function 
in accordance with the position paper. 

Paragraph 10 of this Position 

Paper has reference. Non- 
compliance to the Municipal 

Finance Management Act, 

No. 56 of 2003 not to have an 

internal audit unit. 





The internal audit unit is an 

essential contribution in the 
internal controls instituted by 
the municipalities. As such the 
role of the internal audit 
function as explained in this 

Position Paper will be part of 
the municipalities risk 
management activities. 





Not having the capacity will 
result in the risks associated 
with the implementation of 
mSCOA not being sufficiently 
addressed by the governance 
structures of the 
municipalities. 
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Reference / Date From 

Number 

Query 

Response 


The involvement of internal 
audit is adding a preventative 
control measure to the control 

environment inherent to the 
municipality. The absence 
thereof increases the 
organisational risk taken by the 
municipality. 



What happens if there is an external auditing firm 
performing the internal auditing function. 

Does not matter if the internal 
audit function is performed in- 
house, outsourced or co- 
sourced. The consideration 
addressed in this position 
paper need to be scoped into 
the annual audit plan. 



My problem is what if the service provider wants to 
protect their IP and the external audit capacity 
within the internal audit function is not allowed 
access to the systems for the sake of IP protection. 
Should this be an issue? 

Yes, this will pose a problem. 

Limitation placed on allowing 
access to external auditors in 
their capacity as internal 
auditors will place a scope 
limitation on the scope of work 
performed by the auditors. 

The content of this Position 

Paper certainly does not 
expose the system vendor to 
any risks from an intellectual 
property perspective. 
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Reference / Date 

From 

Number 

Query 

Response 

Email and 

Letter 

dated 9 

May 2016 

Hilton Renald 

uMhIathuze 


The paper is well written and very 
comprehensive. From piloting this 
initiative, the uMhIathuze 

Municipality advises that the 
following be added to ensure 
effectiveness of the internal audit 
plays in the project: 

Comment noted. 


Firstly, the paper correctly high-lights 
the internal audit role in the project 
planning and execution, however 
what is of equal importance is the 
role they play when going live. 
Although in a well-managed project 
there will be user acceptance testing 
and training prior to going live, the 
reality of going live will illicit its own 
set of data migration and 
transactional challenges. Internal 
audit needs to play a "due diligence 
role". 


Secondly, this reform roll-out is not 
"business as usual", hence both prior 
and post going live, internal audit 
needs to place special emphasis to 
the mSCOA project. 


This concept is discussed in the 
following section of the 
Position Paper: EIGHT-STEPS 
TO CONSIDER IN THE 
INTERNAL AUDIT PROCESS 


This concept is discussed in the 
following section of the 
Position Paper: Step 8: 
Complete the Overall Audit 
Analysis of the Implementation 
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Reference / Date From Number Query Response 


Due to limited resources in the This concerned is discussed in 

Country, the additional scope of work Paragraph 38 of this Position 

that arise from this reform must not Paper. 

simply be added to the normal audit 

plan, but instead where necessary 

defer normal/conventional scope to 

post a stable mSCOA complaint 

system i.e. unless the National 

Treasury will add funding for 

additional Internal Audit, it is 

suggested that audit plans normal 

annual program be reviewed 

specifically to address both prior and 

post going live detailed audit system 

and transactional testing. 
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ANNEXURE D- NATIONAL TREASURY^ DOCUMENTS 10 BE REVISED POIXOV\/ING 
THEADOPnON OFTHIS POSITION IV^PER 

National Treasury Internal Audit Framework (March 2009 2*^^ Edition) 

2. The guideline need to be revised to give consideration to the Institute of Internal Auditors'(IIA) 
International Standards for the Professional Practice of Internal Auditing (ISPPIA) and the 
Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework on 
internal control. 
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